What causes "Could not read environment variables" in apache/kafka?

Inspect the ERROR log 'Could not read environment variables' and its stack trace to identify the underlying cause.

apache/kafka · error · ConfigException

Could not read environment variables

Error message

Could not read environment variables

What it means

Thrown as ConfigException by EnvVarConfigProvider.getEnvVars() (invoked from the no-arg constructor) when System.getenv() raises any Exception. The catch is broad (Exception) because environment access is normally infallible on the JVM; a throw indicates a serious system-level problem. The exception is logged with full stack trace before being wrapped.

Source

Thrown at clients/src/main/java/org/apache/kafka/common/config/provider/EnvVarConfigProvider.java:118

            throw new ConfigException("Path is not supported for EnvVarConfigProvider, invalid value '" + path + "'");
        }

        if (keys == null) {
            return new ConfigData(filteredEnvVarMap);
        }

        Map<String, String> filteredData = new HashMap<>(filteredEnvVarMap);
        filteredData.keySet().retainAll(keys);

        return new ConfigData(filteredData);
    }

    private Map<String, String> getEnvVars() {
        try {
            return System.getenv();
        } catch (Exception e) {
            log.error("Could not read environment variables", e);
            throw new ConfigException("Could not read environment variables");
        }
    }
}

View on GitHub (pinned to c31c9215e1)

Solutions

Inspect the ERROR log 'Could not read environment variables' and its stack trace to identify the underlying cause.
If a SecurityManager is installed, grant the required permission or remove the manager (note: SecurityManager is deprecated/removed in modern JDKs).
Switch to the EnvVarConfigProvider(Map) constructor by passing env vars explicitly as a workaround.
Restart on a known-good JVM version if the cause is a JVM/OS environment bug.

Example fix

// before
EnvVarConfigProvider p = new EnvVarConfigProvider();

// after (workaround: inject env map explicitly)
EnvVarConfigProvider p = new EnvVarConfigProvider(System.getenv());

Defensive patterns

Strategy: try-catch

Validate before calling

// Limited pre-validation possible (System.getenv can throw at any time).
// Best effort: use the Map-based constructor when you control the env source:
Map<String, String> snapshot;
try {
    snapshot = System.getenv();
} catch (SecurityException se) {
    snapshot = Collections.emptyMap(); // or fail loudly per policy
}
EnvVarConfigProvider p = new EnvVarConfigProvider(snapshot);

Try / catch

try {
    EnvVarConfigProvider p = new EnvVarConfigProvider();
} catch (ConfigException e) {
    if (e.getMessage().equals("Could not read environment variables")) {
        // fall back to the Map constructor with an explicit env map, or disable the provider
    } else { throw e; }
}

Prevention

Ensure the runtime SecurityManager / container seccomp profile permits System.getenv(); grant the permission in policy files if needed.
In sandboxed or custom classloader setups, prefer new EnvVarConfigProvider(envMap) so env access is explicit and testable.
Log the original exception cause (it is captured in the provider's log) when diagnosing why getenv failed.

When it happens

Trigger: Constructing new EnvVarConfigProvider() when System.getenv() throws, which is rare and typically tied to a misbehaving SecurityManager, a corrupted process environment, or a JVM/OS-level fault. Most call sites instantiate the provider indirectly through the ConfigTransformer during config-provider setup.

Common situations: A restrictive SecurityManager denying access to environment variables (deprecated but possible on legacy JVMs). Corrupted process environment block. Native interop or agent interfering with getenv. Very rarely, a JVM bug in environment parsing on the host OS.

Related errors

AI-assisted analysis of apache/kafka@c31c9215e1 (2026-08-03). Data as JSON: /data/errors/3c90542cc1c1f4ee.json. Report an issue: GitHub.